DPDP Act for restaurants in India: guest data, consent and the May 2027 deadline

Every booking your restaurant takes is personal data: a name, a mobile number, often an email address, sometimes a note that says "pure veg", "Jain, no onion no garlic" or "anniversary, window table". Multiply that by every walk-in you noted down, every WhatsApp thread with a regular and every festive-season group enquiry, and even a single-outlet restaurant is holding a guest database that India's new data protection law treats seriously.

That law is the Digital Personal Data Protection Act, 2023 (DPDP Act), and its defining feature for restaurateurs is timing. The Act was passed in August 2023, the DPDP Rules were notified on 14 November 2025, and the substantive duties on ordinary businesses, consent, notice, security safeguards, breach notification, only become enforceable about 18 months after notification, which lands around May 2027. In other words: as of today you are still governed by the older IT Act regime, but you have a known deadline, no small-business exemption, and penalties that go up to ₹250 crore. The restaurants that will find May 2027 painless are the ones that clean up their guest data habits now, starting with where the guest list lives: scattered across staff phones and paper diaries, or inside a reservation system that keeps it in one place and keeps it yours.

The short version:

• the DPDP Act will apply to every business that processes digital personal data, from a two-table café to a hotel chain, with no turnover threshold;
• as of October 2026, the operative regime is still the IT Act 2000 (section 43A) and the SPDI Rules 2011; the DPDP Act's duties on businesses phase in around May 2027;
• booking data a guest volunteers to get a table is the easy part; using that same mobile number for promotional blasts is the part that needs real consent;
• marketing by SMS already has its own regime today: TRAI's DLT registration rules, tightened in February 2025;
• WhatsApp marketing needs a documented opt-in under Meta's own policy, before any data protection law even enters the picture;
• penalties under the DPDP Act go up to ₹250 crore for failing security safeguards, and the Data Protection Board that will impose them was constituted in November 2025.

What guest data a restaurant actually holds

Most restaurateurs never think of themselves as running a data operation. Take stock of what a typical Indian restaurant collects:

• Bookings and the walk-in queue: names, mobile numbers, emails, party sizes, dates and times, table preferences.
• Service notes: veg/non-veg and Jain preferences, allergies, birthdays and anniversaries, "VIP, knows the owner".
• Payment traces: UPI references and payment-link records for advances on large tables and festive nights.
• Marketing lists: numbers saved from WhatsApp enquiries, loyalty sign-ups, exported spreadsheets from an aggregator dashboard.
• CCTV footage of the dining room, plus staff records.

Under the DPDP Act, your restaurant is a data fiduciary for all of it: the entity that decides why and how the data is processed. A booking platform or POS vendor holding that data on your behalf is a data processor, but the responsibility for compliance stays with you. That is worth reading twice before you assume your software vendor's compliance is your compliance.

Where the law stands today, and when it changes

The DPDP Act's rollout is deliberately phased, and getting the phases right matters because most of what is written about the Act reads as if it were already in force. It is not, for restaurants, yet.

• August 2023: the DPDP Act is passed. Nothing operative for businesses yet.
• 14 November 2025: the DPDP Rules, 2025 are notified, starting the clock. The institutional provisions take effect immediately.
• November 2025: the Data Protection Board of India is constituted in New Delhi, the body that will hear complaints and impose penalties.
• Around November 2026: the consent-manager provisions come into force, 12 months from notification.
• Around May 2027: the substantive obligations on businesses become enforceable, 18 months from notification: notice and consent, security safeguards, breach notification, data principal rights, erasure.

Until that last date, the operative statute for a restaurant's guest data is still the Information Technology Act, 2000, section 43A, with the SPDI Rules, 2011: an obligation to maintain reasonable security practices for sensitive personal data, which covers things like payment information and health details (an allergy note qualifies). It is a much thinner regime, which is exactly why the DPDP Act exists. The practical takeaway is not "relax until 2027"; it is that you have a defined runway, and the Data Protection Board will not be starting from zero when it opens for business.

One line of contrast for anyone who has read about Europe's GDPR: the DPDP Act is leaner, consent-centric and digital-only, but it shares the core idea that the guest's data belongs to the guest, and it borrows the headline-grabbing penalty logic.

What the DPDP Act will require of your restaurant

The duties, translated from statute into dining-room terms:

Notice and consent, or "legitimate uses"

The default rule is that you process personal data with the guest's consent, after a clear, itemised notice of what you collect and why. But the Act's section 7 "certain legitimate uses" does a lot of quiet work for restaurants: when a guest voluntarily provides data for a specified purpose, you may process it for that purpose without a separate consent ceremony. A guest who gives a name and mobile number to book a table has volunteered that data to get the table. Taking the booking, confirming it and reminding the guest about it sit comfortably inside that purpose.

What does not sit inside it is marketing. The mobile number given for Saturday's table is not thereby consented to Diwali promo blasts. Under the DPDP Act, marketing is its own purpose and needs its own, provable, withdrawable consent. Keep the opt-in a separate, deliberate choice, never bundled into "book a table".

Security safeguards

Reasonable security measures over guest data: access controls, encryption or equivalent protections via your vendors, and basic hygiene like unique staff logins and revoking access when someone leaves. This is the obligation with the largest penalty attached: up to ₹250 crore for failing to maintain safeguards, per the Act's schedule (Act and Rules text at MeitY).

Breach notification

If guest data is breached, you will have to notify the Data Protection Board and the affected guests. Failure to notify carries penalties up to ₹200 crore. A restaurant-scale breach is rarely a cinema plot; it is a phished password, a lost phone full of guest chats, or an exported spreadsheet emailed to the wrong person.

Erasure and guest rights

Guests will have the right to access, correct and erase their data, and you will be expected to delete personal data once its purpose is spent. Years-old waitlist exports and stale number lists serve nobody and enlarge every breach.

No small-business exemption

The Act applies regardless of size. The government can exempt notified classes such as startups from some provisions, but there is no blanket carve-out for small businesses, and nothing suggests neighbourhood restaurants will get one. A law-firm analysis aimed squarely at hospitality put it well: the welcome desk is becoming a data desk.

Marketing messages: the rules that already apply today

Here is the part many restaurateurs miss: even before the DPDP Act bites, promotional messaging in India is already regulated, on two separate tracks.

SMS: TRAI and DLT registration

Any commercial SMS in India runs through TRAI's TCCCPR regime: the sender must be registered on a DLT (Distributed Ledger Technology) platform with approved headers and templates, and promotional messages may only go to numbers that are not on the DND register, or that have consented. The TCCCPR Amendment of 12 February 2025 tightened the system further: mandatory header suffixes identifying message types from May 2025, stricter template categories, and a lower complaint threshold for action against senders.

The clean distinction to internalise: a transactional or service message ("your table for 4 at 8 pm is confirmed") is fine through registered service headers. A promotional message ("flat 20% off this weekend") needs consent and DND scrubbing. The moment your reminder adds a promotional line, it changes category.

WhatsApp: Meta's opt-in policy

WhatsApp traffic sits outside the DLT regime, but Meta enforces its own rule: a business must obtain opt-in before sending business-initiated messages, the opt-in must name your business, and marketing templates are reviewed and rate-limited on quality. Restaurants that blast unsolicited promos get their numbers throttled or banned by Meta long before any regulator notices. If WhatsApp is your front door for bookings, and in India it usually is, our guide to running table bookings over WhatsApp without the chaos covers where the channel works and where it breaks.

From May 2027, DPDP consent requirements layer on top of both tracks: the safe architecture is one you can build today. Transactional confirmations and reminders in one stream, tied to the booking. Marketing in another, tied to a timestamped opt-in. Our piece on restaurant email marketing follows the same split, and a clean opted-in list outperforms a padded one in any country.

Why scattered guest data is the real compliance risk

Picture the audit trail of a typical busy restaurant in Mumbai or Bengaluru today: bookings in a paper diary, regulars' numbers saved on the manager's personal phone, a WhatsApp group where staff forward booking screenshots, an Excel export from an aggregator dashboard on the owner's laptop, and service notes ("Jain", "nut allergy", "always complains about the AC") living in individuals' heads or chat threads.

Every DPDP duty is harder in that setup. You cannot give notice about data you cannot locate. You cannot honour an erasure request across five staff phones. You cannot secure a guest list that walks out the door inside a departing manager's contacts. And you cannot prove marketing consent you never recorded.

A single reservation book fixes most of this structurally, which is why the compliance argument and the operations argument point the same way. One system holds bookings, walk-ins and guest notes; staff access it with their own logins instead of their own phones; the marketing list is separate from the booking data; and the history is in one exportable place. We made the broader case in why a digital reservation book beats the paper diary, and the no-show economics point the same direction: structured guest data is also what makes confirmations and reminders that cut no-shows in India possible at all.

Let us be honest about our own position: ViteUneTable is a reservation system, so we are not neutral. What we can state factually is the model. With ViteUneTable, the guest data belongs to the restaurant and is exportable at any time; there is no marketplace emailing or retargeting your diners; and the free version is unlimited, with 0% commission and no per-cover fees. Automatic email confirmations and reminders come with the Pack Standard at €29 per month excluding tax (about ₹3,150 at October 2026 rates; billing is in euros, since the company is European, so factor the exchange rate as you would with any USD-billed platform). ViteUneTable does not send WhatsApp or SMS messages, so the DLT question never arises on our side: reminders travel by email, the channel with the simplest consent story for transactional use.

A DPDP readiness checklist for 2026

You do not need a compliance consultant to be ready by May 2027. You need habits:

1. Map what you hold. List every place guest data lives: diary, phones, spreadsheets, booking system, aggregator dashboards. If the list scares you, that is the point.
2. Consolidate into one system. One reservation book for bookings, walk-ins and guest notes, with per-staff logins.
3. Collect the minimum. Name, mobile number, party size, email for confirmations. No ID numbers, no date of birth unless a guest joins a birthday programme.
4. Split marketing from booking. The promo opt-in is a separate, unticked, timestamped choice. Booking data is for the booking.
5. Respect the channels' own rules today. DLT registration before any marketing SMS; documented opt-in before any business-initiated WhatsApp; keep reminders purely transactional.
6. Guard the sensitive notes. Allergies and dietary or religious preferences are for service staff, never in a marketing export.
7. Set a retention habit. Delete stale exports and years-old lists; less data means a smaller breach.
8. Know your vendors' answers in writing. Who owns the guest data, is it exportable, where is it processed, and does the platform market to your guests?
9. Write the one-page breach plan. Who changes the passwords, who assesses the damage, who informs guests.
10. Name an owner. In an independent restaurant, the person responsible for guest data is usually you. Write it down anyway.

Frequently asked questions

Does the DPDP Act apply to a small restaurant?

Yes, once its substantive provisions are in force. The Act applies to businesses processing digital personal data regardless of size or turnover, and there is no blanket small-business exemption. The government may exempt notified classes such as startups from some provisions, but no exemption for restaurants exists.

When do restaurants actually have to comply?

The DPDP Rules were notified on 14 November 2025 with a phased schedule: the Data Protection Board came first, consent-manager provisions follow about 12 months after notification, and the substantive duties on businesses, consent, notice, security, breach notification, apply about 18 months after notification, which lands around May 2027. Until then, the IT Act 2000 and the SPDI Rules 2011 remain the operative regime.

Do I need consent just to take a booking?

Taking a booking is the easy case. When a guest voluntarily gives a name and number to reserve a table, the Act's "certain legitimate uses" provision covers processing for that purpose, including confirming and reminding. Separate, provable consent is needed when you use the same data for something else, above all marketing.

Can I send promotional WhatsApp or SMS messages to past guests?

Not on the strength of a past booking alone. Marketing SMS already requires DLT registration under TRAI's rules and may only target consenting or non-DND numbers; WhatsApp marketing requires a documented opt-in under Meta's policy. From around May 2027, the DPDP Act adds a consent requirement of its own. Build the opt-in habit now.

What are the penalties under the DPDP Act?

The schedule tops out at ₹250 crore for failing to maintain reasonable security safeguards, and ₹200 crore for failing to notify a data breach. Penalties will be imposed by the Data Protection Board of India, constituted in November 2025. For an independent restaurant the realistic exposure is smaller, but the law's ceiling signals how seriously guest data will be treated.

Is an aggregator's guest data my problem too?

The diner data a platform collects for its own app is the platform's responsibility. But data processed on your behalf, your booking list inside any system, remains yours to answer for as the data fiduciary, whatever the contract says. That is a good reason to ask any platform, in writing, who owns the guest list and whether you can export it.